Our app is a class IIa device in the EU. Do we report under the CRA?
Not for that app. The MDR applies to it, so Article 2(2) takes it out of the CRA. Vigilance and post-market obligations under the MDR continue to apply in full.
Cybersecurity
CRA reporting starts on 11 September 2026, and the device exemption is narrower than it reads
Most manufacturers we speak to have read Article 2 of the Cyber Resilience Act, found their device excluded, and closed the file. The exclusion is real. It attaches to the product the MDR applies to, not to everything a company ships around it.
What the exclusion actually says
Article 2(2) of Regulation (EU) 2024/2847:
This Regulation does not apply to products with digital elements to which the following Union legal acts apply: (a) Regulation (EU) 2017/745; (b) Regulation (EU) 2017/746; (c) Regulation (EU) 2019/2144.
The test is whether the MDR applies to that product with digital elements. Software that is itself a device, and software that is an accessory to a device, sits inside the MDR and outside the CRA. A hospital analytics portal that carries no medical purpose, a fleet management dashboard, a consumer wellness app shipped alongside the regulated one, a firmware update service sold to distributors: none of those is excluded because the company also makes a device.
Why the September date arrives before the rest of the Regulation
Article 71 of the CRA sets the general date of application at 11 December 2027. It then pulls two parts forward. Chapter IV, on the notification of conformity assessment bodies, applies from 11 June 2026. Article 14, on reporting, applies from 11 September 2026.
That sequencing matters for planning. A manufacturer whose non-device software falls in scope does not have until 2027 to build an incident process. From September it has to be able to file an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a fuller notification within 72 hours, and a final report no later than 14 days after a corrective or mitigating measure is available.
Where a typical connected device portfolio lands
The classification is done product by product, on intended purpose, not on company type.
| Component | Usual regime | Practical consequence |
|---|---|---|
| The device and its embedded software | MDR | Cybersecurity handled through Annex I, the technical documentation and post-market surveillance |
| Companion app with a medical purpose | MDR | A device or an accessory in its own right, classified under Annex VIII |
| Cloud portal without a medical purpose | CRA | In scope as a product with digital elements, including its remote data processing |
| Wellness or lifestyle app shipped alongside | CRA | In scope, and the reporting duty applies from September 2026 |
| Third-party libraries and supplier software | CRA, at the supplier | Supplier notifications become inputs your post-market system has to receive and assess |
| Service tools for distributors and technicians | CRA | Frequently overlooked because it is not sold to patients |
The supply chain effect on an MDR file
Even where every product a manufacturer places on the market is a device, the CRA changes the environment around it. Suppliers of software components are in scope and will be reporting actively exploited vulnerabilities on a 24-hour clock. Those reports have to land somewhere in the manufacturer post-market surveillance system and be assessed against the device risk file, because the MDR obligation to keep the technical documentation current does not pause while a supplier handles its own notification.
For a manufacturer outside the Union, the address for the European side of that traffic is normally the authorised representative. It receives complaints and reports, forwards authority requests and holds the documentation copy, so it is the first party to notice when a supplier advisory has no owner on the manufacturer side.
Questions from software and connected device teams
We sell the same app in a wellness version outside the medical claim. Which regime?
The wellness version is assessed on its own intended purpose. If the MDR does not apply to it, the CRA can.
Does the CRA reporting duty replace MDR vigilance?
No. They are separate systems with separate recipients and separate clocks. A single event can trigger both.
Who reports if the software is developed by a contractor?
The manufacturer that places the product on the market under its name carries the duty. Contractual arrangements move the work, not the obligation.
Official basis checked on 15 August 2026
The MDR provisions cited on this page were checked against the official EUR-Lex text.
Regulation (EU) 2017/745 (MDR) in EUR-Lex →
Plan the EU route
Map the work before committing to a certification timeline.
Use the US-to-EU hub to separate reusable evidence from European work, or review the wider service scope for manufacturers established outside the Union.